CVE-2025-57803

What it actually does

32-bit integer overflow in the BMP encoder’s scanline-stride computation causes bytes_per_line to collapse to a tiny value; the per-row writer still emits 3 × width bytes for 24-bpp images, allowing the row base pointer to advance using the overflowed stride and immediately write attacker-controlled bytes past the allocated slot into adjacent heap memory.

Why it matters to the business

Systems that automatically convert or process untrusted BMP images with ImageMagick on 32-bit builds can suffer memory corruption that leads to crashes or potential code execution, disrupting image-handling workflows across many organizations and downstream packages.

How an attack unfolds

An attacker supplies a crafted 24-bpp BMP image whose width triggers the stride overflow during encoding; the corrupted write primitive corrupts heap metadata or adjacent objects, enabling further exploitation in auto-convert pipelines.

How to fix it

Upgrade imagemagick/imagemagick to commit 2c55221f4d38193adcb51056c14cf238fbcc35d7 and imagemagick/imagemagick6 to commit 2fe4a1049f469029878b05426cbbf652a94006f8 (corresponding to versions 6.9.13-28 and 7.1.2-2). Rebuild any dependent packages and restart affected services.

How to confirm the fix worked

Verify installed versions report 6.9.13-28 or newer (6.x) and 7.1.2-2 or newer (7.x); run regression tests with width values that previously triggered the stride overflow and confirm no heap writes occur outside allocated buffers.

Typical attack path

1. Attacker crafts a malicious 24-bpp BMP with width chosen to overflow the 32-bit stride calculation
2. Victim system receives the image via upload, email attachment, or web conversion
3. ImageMagick BMP encoder computes an under-sized bytes_per_line and begins writing rows
4. First row write overflows into adjacent heap memory with controlled data
5. Heap corruption is leveraged for control-flow hijacking or information disclosure

How to detect it

Review application logs and process crash dumps for BMP encoding paths that terminate with heap-related faults; correlate file-processing timestamps with conversion jobs that handled BMP images.

What your security team should do

• Immediately update all 32-bit ImageMagick installations to the listed fixed commits
• Disable BMP support or enforce strict input validation where upgrades are delayed
• Add ImageMagick version checks to build and deployment pipelines
• Monitor EPSS trend and re-evaluate if exploit maturity increases